Security audit
Security checks for vulnerabilities and agentic risk
This skill is a narrowly scoped Tencent Cloud article-to-Markdown extractor with disclosed network use and optional user-directed file output.
Install only if you want agents to fetch public Tencent Cloud developer articles and optionally save Markdown files. Review the output path before using the save option, since the script writes wherever the user-provided path points.
The skill invokes a script that performs outbound HTTP requests to fetch article content, but the manifest does not declare any tool scope such as network permissions or allowed tools. This creates a transparency and governance gap: an agent may be granted broader capabilities than the skill explicitly advertises, making review, sandboxing, and policy enforcement harder.
The script hard-codes Chinese locale and Shanghai timezone via toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' }), which imposes a specific language/locale choice on all users. This matches the policy category for locale/language constraints because the file does not offer a user choice or explain that the tool is intentionally region-specific.
No suspicious patterns detected.
